TrymeLocker WH_KEYBOARD_LL Hook via user32.dll Load from Non-Standard Path

Ibrahim Saud@tektrix

•updated Jun 28, 2026•2•0•1

Detects keylogging behavior associated with the TrymeLocker malware. The rule monitors for processes executing from non-standard, potentially writable directories (such as Temp, AppData, or ProgramData) that load user32.dll. This activity is indicative of an attempt to install a global Windows hook (SetWindowsHookEx) to intercept keystrokes (WH_KEYBOARD_LL).